The consultant should discuss with the IT department that the code of open source solutions is directly accessible, which means that they can view, modify, and customize it according to their needs. However, this also means that they are responsible for maintaining and updating the code, as well as ensuring its security and compatibility. The code of open source solutions is not maintained by Salesforce developers or updated via Salesforce Releases. Reference:
https://trailhead.salesforce.com/en/content/learn/modules/open-source-commons/open-source-basics
https://trailhead.salesforce.com/en/content/learn/modules/open-source-commons/open-source-projects